Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Asking the U.S. to allow Google to publish more national security request data

googleblog.blogspot.com

Post reply on HN
Print view View original

151–160 of 189 posts

Re: Asking the U.S. to allow Google to publish more national security request data

#151

Post by mokus »

bo1024 wrote: post #142
kvb wrote: post #118

Earlier quoted context omitted.

What lies have companies told?

From the news I've read, my understanding about FISA is that if someone asks you whether you've been subject to one, you're legally obligated to lie and say no. Right, or am I missing something?

If that is the case, it seems like a very risky move. If I were so ordered, for example, I would immediately seek to challenge it on the basis of the first amendment. Not the free speech part - the free exercise of religion part. My religion explicitly states "thou shalt not lie".

EDIT: well, technically it says not to 'bear false witness against thy neighbor', but it certainly would not be hard to justify a religious objection to that requirement.

Re: Asking the U.S. to allow Google to publish more national security request data

#152

Post by burntsushi »

1morepassword wrote: post #121
slg wrote: post #7

This is the kind of response I was expecting from tech companies. The mistrust of the government has extended to this industry and we can't simply rest on a simple denial of the accusations. Many people now believe that companies like Google send a complete copy of their entire customer records to the NSA. That is a dangerous belief and like discussed on other threads here, it could really damage the long term viabil…

> mistrust of the government has extended to this industry I'm sorry, are we now taking the opportunity to blame big evil government for this? The mistrust of this industry has always existed as a completely separate issue due to the utter lack of respect for privacy and privacy related laws, an attitude of which Google is one the most prominent exponents. This is a company that lobbies governments against privacy pr…

You have a valid point, but you're overlooking a really crucial difference: data in the hands of a corporations means something entirely different from data in the hands of government. One of them has a monopoly on the use of force and the other doesn't. At least, that's the distinction that is important to me.

Re: Asking the U.S. to allow Google to publish more national security request data

#153

Post by etherael »

From here on in this is the only privacy model I will consider trustworthy for a cloud service;

You have the encryption key, the data on our servers is completely useless without that encryption key. We are physically unable to be compelled to comply with any orders to violate your privacy from anyone.

The only example of a cloud service I can think of that matches this off the top of my head is spideroak and tarsnap, perhaps also the new torrent sync? I'm not entirely certain how that works but I do recall a client side crypto key being involved in there somewhere?

Re: Asking the U.S. to allow Google to publish more national security request data

#154

Post by plywoodtrees »

TomGullen wrote: post #138
floitsch wrote: post #75

Earlier quoted context omitted.

Disclaimer: I work at Google. I'm working on the client-side (Chrome) and my knowledge in the server area is therefore limited, but from my understanding this would be really hard. 1. Googlers have access to almost all source code. It would be difficult to hide code that just sends data to an outside entity. 2. Google continually monitors its (internal) bandwidth. This is done to optimize traffic, and detect intruder…

I see a big potential benefit for the NSA to have a spy within google who simply manually pulls and relays info on people at th nsa's request... It doesn't have to be a full Api

Extracting and sending it manually seems incompatible with the idea that they're doing this on a really massive scale.

Also, forwarding all of everybody's gmail would be a lot of data transiting the network. Unexpected traffic equal to all of gmail's normal traffic could be noticed.

Re: Asking the U.S. to allow Google to publish more national security request data

#155

Post by DannyBee »

bo1024 wrote: post #109
saalweachter wrote: post #73

While I'd like to know how many secret requests are being made to whom, why should I ever believe any numbers? We're living in crazy-town, maybe we always were. What is to stop the A.G. from publicly saying "Yes, disclose away!" and then to privately send one of those magic-do-anything-we-say requests saying, "Don't disclose X, Y, and Z."? Or if we are given an accurate count today, what is to prevent the government…

Good point. If they can force companies to lie about the existence of FISA requests, why wouldn't they force them to lie about the number of such?

[citation needed].

Again, i have seen this in argument after argument. Nobody has yet provided any legal authority that states it is constitutional or legal for the government to compel forced lies. They can compel silence, for sure.

There is plenty of authority in other contexts (IE not national security), that the government cannot compel you to speak misleading or non-truthful information.

I wish this idea that everyone must be lying because the government can legally, force them to, would stop.

I imagine someone started with the NSL gag orders, which compel silence, and then just started saying they compel you to lie instead (which they don't).

In fact, even the compel silence part of the NSL was found unconstitutional.

Re: Asking the U.S. to allow Google to publish more national security request data

#156

Post by DannyBee »

corresation wrote: post #137
DannyBee wrote: post #136

Earlier quoted context omitted.

You are seriously confused on both points.

What a convincing retort.

Yes, i'm going to describe internal security procedures in detail to a stranger. Suffice to say, the idea that random people in some nebulous "network security" group have access to all traffic related PKI (or whatever) is barely worth responding to.

Google is not made of idiots. It is not a startup run in a garage where every the "IT guy" has access to all the private keys.

Re: Asking the U.S. to allow Google to publish more national security request data

#157

Post by plywoodtrees »

etherael wrote: post #153

From here on in this is the only privacy model I will consider trustworthy for a cloud service; You have the encryption key, the data on our servers is completely useless without that encryption key. We are physically unable to be compelled to comply with any orders to violate your privacy from anyone. The only example of a cloud service I can think of that matches this off the top of my head is spideroak and tarsnap…

You can use things like Duplicity which locally encrypt backups and then store them to arbitrary cloud services.

The problem is, if the data is opaque to the cloud service, it is very hard for it to do anything other than passively store and retrieve it, at which point it is not really a cloud service at all.

And even then: they can give logs to authorities showing what you accessed when and from where, they probably know your credit card and billing details.

Re: Asking the U.S. to allow Google to publish more national security request data

#158

Post by jfoster »

floitsch wrote: post #75
corresation wrote: post #22

What are the legal ramifications if employees at Google also work at the behest of the NSA/FBI/CIA (unbeknownst to Google)? It is one thing to compel the organization to reveal information, but what are the legal questions around essentially spies within the various corporations? This very blog post mentions that Google hires some of the best security engineers in the world. I'm sure having "prior" employment at the…

Disclaimer: I work at Google. I'm working on the client-side (Chrome) and my knowledge in the server area is therefore limited, but from my understanding this would be really hard. 1. Googlers have access to almost all source code. It would be difficult to hide code that just sends data to an outside entity. 2. Google continually monitors its (internal) bandwidth. This is done to optimize traffic, and detect intruder…

1. What if the source code that does this isn't checked in? You would need to verify that the runtime matches the source code. What if it's not spread across Google's entire codebase, and is just in one of the pieces of infrastructure that almost all of the data hits? (eg. map-reduce clusters)

2. The link out to the NSA would need to be massive as well. Would be very difficult to keep that secret. A 4G modem is not going to cut it.

3. Sure, but I imagine the NSA would be happy to put in the maintenance effort required. The data would have high ROI from their perspective.

Re: Asking the U.S. to allow Google to publish more national security request data

#159

Post by jfoster »

jsolson wrote: post #91
floitsch wrote: post #75

Earlier quoted context omitted.

Disclaimer: I work at Google. I'm working on the client-side (Chrome) and my knowledge in the server area is therefore limited, but from my understanding this would be really hard. 1. Googlers have access to almost all source code. It would be difficult to hide code that just sends data to an outside entity. 2. Google continually monitors its (internal) bandwidth. This is done to optimize traffic, and detect intruder…

> 3. Google's infrastructure changes. You can't just install a gateway to the NSA and expect it to continue working for a long time. It's not as if user-data was stored in simple text-files. I think this was the biggest bullshit signal for me (also a Googler, although a recent addition). The high rate of change of Google's infrastructure is astounding when you consider the scale it operates at. The notion of trying t…

Google's own apps keep up with the infrastructure changes. Why would an NSA backdoor be any different to just another Google app?

Re: Asking the U.S. to allow Google to publish more national security request data

#160

Post by jsolson »

jfoster wrote: post #159
jsolson wrote: post #91

Earlier quoted context omitted.

> 3. Google's infrastructure changes. You can't just install a gateway to the NSA and expect it to continue working for a long time. It's not as if user-data was stored in simple text-files. I think this was the biggest bullshit signal for me (also a Googler, although a recent addition). The high rate of change of Google's infrastructure is astounding when you consider the scale it operates at. The notion of trying t…

Google's own apps keep up with the infrastructure changes. Why would an NSA backdoor be any different to just another Google app?

That was sort of my point: those apps require sizable teams and a huge amount of cooperation from dependencies.

If you're operating in secret, cooperation is going to be a hard commodity to come by. I also feel like a sizable team of the sort of people who work at Google would inevitably have leaked something about this before now.

Post reply on HN